Getting 401 from ajax using an application password

You should use cookie based authentication instead of basic auth. Delete the basic auth/application password authentication code.

Follow the cookie authentication example that creates a post via the REST API from the REST API handbook:

https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/#cookie-authentication

1. Create a valid nonce for use in your AJAX requests in PHP wp_create_nonce( 'wp_rest' ) as the docs tell you to
2. Add a beforeSend to your AJAX call like the docs suggest that adds the nonce in a HTTP header:

    beforeSend: function ( xhr ) {
        xhr.setRequestHeader( 'X-WP-Nonce', your_nonce_variable );
    },

3. Make the request while logged into the site from the same domain